{"id":10594,"date":"2014-04-23T12:13:07","date_gmt":"2014-04-23T12:13:07","guid":{"rendered":"http:\/\/www.journeytothecloud.com\/?p=3783"},"modified":"2014-04-23T12:13:07","modified_gmt":"2014-04-23T12:13:07","slug":"how-our-managed-services-team-responded-to-heartbleed","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/how-our-managed-services-team-responded-to-heartbleed\/","title":{"rendered":"How our Managed Services Team Responded to Heartbleed"},"content":{"rendered":"

By Jay Keating, Vice President of Managed Services<\/p>\n

 <\/p>\n

A lot has been written about the Heartbleed bug impacting versions of OpenSSL software in recent weeks. For an in-depth description of what Heartbleed is and how to respond to the vulnerability, you can refer to <\/span>http:\/\/heartbleed.com\/<\/span><\/a> or any number of 3<\/span>rd<\/span><\/sup> party reports. This blog won\u2019t review the actual weakness, but rather describe how our Managed IT Services team responded to the incident in support of our customers.<\/span><\/span><\/span> <\/span><\/p>\n

As software and hardware vendors release code updates to deal with vulnerabilities such as Heartbleed, our Managed IT Services team assesses overall risk in context to mitigating factors and then recommends a course of action. In the case of Heartbleed, since the scope was so broad, we prioritized our assessment in the following tiers:<\/span><\/p>\n

    \n
  1. We quickly evaluated our internal systems and support tools. This important step had to happen immediately so our own management tools weren\u2019t creating risk or concern for our customers.<\/li>\n
  2. We then evaluated all Managed IT Services customers\u2019 Internet-facing devices such as firewalls and web servers. All devices that were exposed have been patched at this point, and customers were notified of the risk and mitigation plan immediately. In this case, given the extent of the exposure, we declared emergency maintenance windows with our customers rather than wait for pre-approved monthly maintenance windows.<\/li>\n
  3. Finally, with the Internet-facing systems no longer vulnerable, we have refocused on our customers\u2019 internal networks for the next round of assessments and mitigation. As we work through this phase, we will once again work collaboratively with our Managed IT Services customers to coordinate an acceptable maintenance window as soon as possible.<\/li>\n<\/ol>\n

    With Heartbleed still top of mind, I suggest a few moments of reflection to think through how your organization responded.\u00a0 Here are some questions to help frame your review:<\/span><\/p>\n